Home

Introduction

Welcome to the Tado teardown wiki.

I was fed up with there being no solution to the poor coverage of the Tado Internet Bridge device. I tried placing it in many different locations within my home but it would never connect to all devices at once. There are two solutions I came up with:

1. Improve the RF range by redeveloping the hardware, or
2. Develop a repeater device

Option 1 would likely be too costly to develop in terms of time and money, and option 2 would be too time consuming, so I opted to look into both a little deeper before making a decision. To begin with, the Tado Internet Bridge would need to be reverse engineered to understand the hardware design and communication protocols used within the device.

Breaking the design into several sections

• Inside the Internet Bridge - General teardown and analysis of the PCB.
• RF Hardware - Description of the 868MHz hardware and how to improve range by modifying the hardware.
• CC110 Register Configuration - Breakdown the configuration of the RF transceiver.
• RF PHY Parameters - The RF parameters used to communicate between devices.
• Over-The-Air Packet Sniffing - Introduction to sniffing Tado packets over the air.
  • TI Packet Sniffer 2 - A guide to installing and configuring TI's Packet Sniffer 2 (THE BEST OPTION)
  • TI Packet Sniffer 1 (2.18.1) - A guide to installing and configuring TI's Packet Sniffer 1 (version 2.18.1)
• Over the air protocol analysis
  • Tado 868MHz Wireshark dissector - An over-the-air protocol dissector for Wireshark developed using the TI Packet Sniffer 1 (2.18.1) hardware.
  • Tado-868-MHz-Link-Protocol - A document describing the complete over-the-air MAC, link and network layers of the protocol.

---

Teardown and analysis by Stephan de Georgio 2025.